T1036.005

Official Description

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)

Tactics: Stealth
Platforms: Containers, ESXi, Linux, macOS, Windows
Parent Technique: T1036 · Masquerading
MITRE Version: 3.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (6)

The payload used the filename SecurityHealthServices.exe to resemble a Windows Defender process. KMS Auto Abuse Led to Mining, Remote Access Tools and Ransomware-Themed Scareware; APT36 Link Unconfirmed
SSAStatement.exe used an Adobe-themed name to appear to be a financial statement. CSuite Campaign Uses Phishing, M365 Session Theft and Remote-Access Tools Against US and EU Organizations
The shortcut is disguised as a tax receipt, and the unsigned payload identifies itself as Microsoft's Windows Update Assistant. HVNC Backdoor Uses Fake Tax and DocuSign Lures to Target Latin American Organizations
The article identifies renamed LogMeIn binaries as masquerading. A Playbook for Hardening Remote Access Tools in SMBs
The miner and companion processes used names resembling legitimate system services. Aqua Details Fileless Cryptomining Campaign Targeting Containerized Apps

CVE (3)

Malware (4)

Threat Actors (7)

MITRE ATT&CK (61)

Vendors (12)

Products (34)

Tools (14)

Industries (9)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.